Where the compliance line sits for AI coding prompts

AI tools now suggest diagnosis codes and visit levels right inside the chart. Used well, they catch honest mistakes before a claim goes out. Used badly, they create risk. The difference is rarely the technology. It is where the suggestion comes from, which way it points, and who decides.

Regulators have spent the last two years spelling this out. None of the cases below involved a small independent practice. They still show where the line sits for anyone who bills Medicare. This is a plain reading of public documents, not legal advice.

What OIG said about EMR prompts

In February 2026, the HHS Office of Inspector General released compliance program guidance for Medicare Advantage, its first major update since 1999. It covers health plans and the many others in the program, providers included.

On page 21, OIG lists potentially fraudulent conduct by plans, providers, and others that federal investigations have turned up. One item is "querying physicians via electronic medical record platforms (including prompts generated by artificial intelligence algorithms)" to add diagnoses "that patients did not have or that did not affect the care, treatment, or management of the patient."

The guidance is voluntary. Still, it tells you how OIG reads a prompt: was the diagnosis real, and did it matter to the visit?

Kaiser: old history and late addenda

In January 2026, Kaiser Permanente affiliates agreed to pay $556 million to resolve False Claims Act allegations. The government alleged that Kaiser mined patients' past medical history for diagnoses it had not yet submitted. It then sent its providers "queries" urging them to add those diagnoses through addenda, "often months and sometimes over a year after visits." In many instances, the added diagnoses allegedly "had nothing to do with the patient visit in question." As in every case here, these were allegations, with no finding of liability.

Aetna: a review that only looked one way

In March 2026, Aetna agreed to pay $117.7 million. Part of the case involved a chart review program for payment year 2015. Coders read charts to find every condition the charts supported. When the reviews did not support codes Aetna had already sent, Aetna allegedly left them in place. The Justice Department alleged that Aetna used the results to seek more payment "while ignoring those same results when they indicated Aetna was overpaid."

UCHealth: a level set by a rule

In November 2024, UCHealth agreed to pay $23 million over emergency department visit claims. From late 2017 to early 2021, its hospitals automatically coded certain ED visits as CPT 99285, the top level, whenever vital signs were checked more times than the hours the patient spent in the department. That happened regardless of how sick the patient was or what resources the hospital used. The government alleged UCHealth knew the rule did not meet Medicare billing requirements.

Four questions for any AI you use

Whether you use a scribe, a coding assistant, or a chart checker, these four questions cover most of the risk.

1. Does the suggestion come from today's note? A code belongs on today's claim because of today's care. Past history can matter when it shapes today's plan, but the note should show that.
2. Does it flag both ways? A review that only adds codes or raises levels looks like the Aetna pattern. Good review also tells you when a code is unsupported or a level is too high.
3. Does a person decide? No code or level should reach a claim just because software picked it. The clinician or biller reads the flag, checks the note, and makes the call.
4. Is anything added after the visit, and why? CMS expects services to be documented at the time they are rendered (Program Integrity Manual, chapter 3, section 3.3.2.5). A late entry should complete the record of care you actually gave, with its date and author identifiable and the change permanently marked. A billing prompt alone is not a reason to add a diagnosis.

Ask your vendor these four questions directly. You should get plain answers.

Where Cortex fits

Cortex Lens is a read-only Chrome extension that works inside Practice Fusion. It checks for problems like codes that can't be billed together and a missing left or right, and its flags go both ways. It never edits the chart or submits a claim. A person makes every change. You can see how we test it on our benchmarks page.

The takeaway: before you trust any AI coding suggestion, ask where it came from, which way it points, and who decides.